github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-29 06:27:05 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #90031 from thockin/proxy-cleanup

Browse Source 
kube-proxy: Startup and updates logging
This commit is contained in:
Kubernetes Prow Robot 2020-04-11 06:23:47 -07:00 committed by GitHub
commit eece89a253
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
25 changed files with 242 additions and 219 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
cmd/kube-proxy/app/server_others.go
View File

@ -91,10 +91,10 @@ func newProxyServer(
return nil, fmt.Errorf("unable to register configz: %s", err)
}
protocol := utiliptables.ProtocolIpv4
protocol := utiliptables.ProtocolIPv4
if net.ParseIP(config.BindAddress).To4() == nil {
klog.V(0).Infof("IPv6 bind address (%s), assume IPv6 operation", config.BindAddress)
protocol = utiliptables.ProtocolIpv6
protocol = utiliptables.ProtocolIPv6
}
var iptInterface utiliptables.Interface
@ -199,12 +199,12 @@ func newProxyServer(
// Create iptables handlers for both families, one is already created
// Always ordered as IPv4, IPv6
var ipt [2]utiliptables.Interface
if iptInterface.IsIpv6() {
if iptInterface.IsIPv6() {
ipt[1] = iptInterface
ipt[0] = utiliptables.New(execer, utiliptables.ProtocolIpv4)
ipt[0] = utiliptables.New(execer, utiliptables.ProtocolIPv4)
} else {
ipt[0] = iptInterface
ipt[1] = utiliptables.New(execer, utiliptables.ProtocolIpv6)
ipt[1] = utiliptables.New(execer, utiliptables.ProtocolIPv6)
}
// Always ordered to match []ipt
@ -267,12 +267,12 @@ func newProxyServer(
// Create iptables handlers for both families, one is already created
// Always ordered as IPv4, IPv6
var ipt [2]utiliptables.Interface
if iptInterface.IsIpv6() {
if iptInterface.IsIPv6() {
ipt[1] = iptInterface
ipt[0] = utiliptables.New(execer, utiliptables.ProtocolIpv4)
ipt[0] = utiliptables.New(execer, utiliptables.ProtocolIPv4)
} else {
ipt[0] = iptInterface
ipt[1] = utiliptables.New(execer, utiliptables.ProtocolIpv6)
ipt[1] = utiliptables.New(execer, utiliptables.ProtocolIPv6)
}
nodeIPs := nodeIPTuple(config.BindAddress)

52
cmd/kube-proxy/app/server_others_test.go
View File

@ -214,8 +214,8 @@ func Test_getLocalDetector(t *testing.T) {
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101/64"},
ipt: utiliptablestest.NewIpv6Fake(),
expected: resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIpv6Fake())),
ipt: utiliptablestest.NewIPv6Fake(),
expected: resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIPv6Fake())),
errExpected: false,
},
{
@ -228,14 +228,14 @@ func Test_getLocalDetector(t *testing.T) {
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101"},
ipt: utiliptablestest.NewIpv6Fake(),
ipt: utiliptablestest.NewIPv6Fake(),
expected: nil,
errExpected: true,
},
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "10.0.0.0/14"},
ipt: utiliptablestest.NewIpv6Fake(),
ipt: utiliptablestest.NewIPv6Fake(),
expected: nil,
errExpected: true,
},
@ -265,8 +265,8 @@ func Test_getLocalDetector(t *testing.T) {
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101/64"},
ipt: utiliptablestest.NewIpv6Fake(),
expected: resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIpv6Fake())),
ipt: utiliptablestest.NewIPv6Fake(),
expected: resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIPv6Fake())),
nodeInfo: makeNodeWithPodCIDRs("2002::1234:abcd:ffff:c0a8:101/96"),
errExpected: false,
},
@ -281,7 +281,7 @@ func Test_getLocalDetector(t *testing.T) {
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101"},
ipt: utiliptablestest.NewIpv6Fake(),
ipt: utiliptablestest.NewIPv6Fake(),
expected: nil,
nodeInfo: makeNodeWithPodCIDRs("2002::1234:abcd:ffff:c0a8:101"),
errExpected: true,
@ -289,7 +289,7 @@ func Test_getLocalDetector(t *testing.T) {
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "10.0.0.0/14"},
ipt: utiliptablestest.NewIpv6Fake(),
ipt: utiliptablestest.NewIPv6Fake(),
expected: nil,
nodeInfo: makeNodeWithPodCIDRs("10.0.0.0/24"),
errExpected: true,
@ -350,25 +350,25 @@ func Test_getDualStackLocalDetectorTuple(t *testing.T) {
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "10.0.0.0/14,2002::1234:abcd:ffff:c0a8:101/64"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: resolveDualStackLocalDetectors(t)(
proxyutiliptables.NewDetectLocalByCIDR("10.0.0.0/14", utiliptablestest.NewFake()))(
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIpv6Fake())),
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIPv6Fake())),
errExpected: false,
},
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101/64,10.0.0.0/14"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: resolveDualStackLocalDetectors(t)(
proxyutiliptables.NewDetectLocalByCIDR("10.0.0.0/14", utiliptablestest.NewFake()))(
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIpv6Fake())),
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIPv6Fake())),
errExpected: false,
},
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "10.0.0.0/14"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{
resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("10.0.0.0/14", utiliptablestest.NewFake())),
proxyutiliptables.NewNoOpLocalDetector()},
@ -377,16 +377,16 @@ func Test_getDualStackLocalDetectorTuple(t *testing.T) {
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101/64"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{
proxyutiliptables.NewNoOpLocalDetector(),
resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIpv6Fake()))},
resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/64", utiliptablestest.NewIPv6Fake()))},
errExpected: false,
},
{
mode: proxyconfigapi.LocalModeClusterCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: ""},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{proxyutiliptables.NewNoOpLocalDetector(), proxyutiliptables.NewNoOpLocalDetector()},
errExpected: false,
},
@ -394,27 +394,27 @@ func Test_getDualStackLocalDetectorTuple(t *testing.T) {
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "10.0.0.0/14,2002::1234:abcd:ffff:c0a8:101/64"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: resolveDualStackLocalDetectors(t)(
proxyutiliptables.NewDetectLocalByCIDR("10.0.0.0/24", utiliptablestest.NewFake()))(
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIpv6Fake())),
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIPv6Fake())),
nodeInfo: makeNodeWithPodCIDRs("10.0.0.0/24", "2002::1234:abcd:ffff:c0a8:101/96"),
errExpected: false,
},
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101/64,10.0.0.0/14"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: resolveDualStackLocalDetectors(t)(
proxyutiliptables.NewDetectLocalByCIDR("10.0.0.0/24", utiliptablestest.NewFake()))(
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIpv6Fake())),
proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIPv6Fake())),
nodeInfo: makeNodeWithPodCIDRs("2002::1234:abcd:ffff:c0a8:101/96", "10.0.0.0/24"),
errExpected: false,
},
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "10.0.0.0/14"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{
resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("10.0.0.0/24", utiliptablestest.NewFake())),
proxyutiliptables.NewNoOpLocalDetector()},
@ -424,17 +424,17 @@ func Test_getDualStackLocalDetectorTuple(t *testing.T) {
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: "2002::1234:abcd:ffff:c0a8:101/64"},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{
proxyutiliptables.NewNoOpLocalDetector(),
resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIpv6Fake()))},
resolveLocalDetector(t)(proxyutiliptables.NewDetectLocalByCIDR("2002::1234:abcd:ffff:c0a8:101/96", utiliptablestest.NewIPv6Fake()))},
nodeInfo: makeNodeWithPodCIDRs("2002::1234:abcd:ffff:c0a8:101/96"),
errExpected: false,
},
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: ""},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{proxyutiliptables.NewNoOpLocalDetector(), proxyutiliptables.NewNoOpLocalDetector()},
nodeInfo: makeNodeWithPodCIDRs(),
errExpected: false,
@ -442,7 +442,7 @@ func Test_getDualStackLocalDetectorTuple(t *testing.T) {
{
mode: proxyconfigapi.LocalModeNodeCIDR,
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: ""},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{proxyutiliptables.NewNoOpLocalDetector(), proxyutiliptables.NewNoOpLocalDetector()},
nodeInfo: nil,
errExpected: false,
@ -451,7 +451,7 @@ func Test_getDualStackLocalDetectorTuple(t *testing.T) {
{
mode: proxyconfigapi.LocalMode("abcd"),
config: &proxyconfigapi.KubeProxyConfiguration{ClusterCIDR: ""},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIpv6Fake()},
ipt: [2]utiliptables.Interface{utiliptablestest.NewFake(), utiliptablestest.NewIPv6Fake()},
expected: [2]proxyutiliptables.LocalTrafficDetector{proxyutiliptables.NewNoOpLocalDetector(), proxyutiliptables.NewNoOpLocalDetector()},
errExpected: false,
},

12
pkg/kubelet/dockershim/network/hostport/fake_iptables.go
View File

@ -40,7 +40,7 @@ type fakeTable struct {
type fakeIPTables struct {
tables map[string]*fakeTable
builtinChains map[string]sets.String
ipv6 bool
protocol utiliptables.Protocol
}
func NewFakeIPTables() *fakeIPTables {
@ -51,7 +51,7 @@ func NewFakeIPTables() *fakeIPTables {
string(utiliptables.TableNAT): sets.NewString("PREROUTING", "INPUT", "OUTPUT", "POSTROUTING"),
string(utiliptables.TableMangle): sets.NewString("PREROUTING", "INPUT", "FORWARD", "OUTPUT", "POSTROUTING"),
},
ipv6: false,
protocol: utiliptables.ProtocolIPv4,
}
}
@ -223,8 +223,12 @@ func (f *fakeIPTables) DeleteRule(tableName utiliptables.Table, chainName utilip
return nil
}
func (f *fakeIPTables) IsIpv6() bool {
return f.ipv6
func (f *fakeIPTables) IsIPv6() bool {
return f.protocol == utiliptables.ProtocolIPv6
}
func (f *fakeIPTables) Protocol() utiliptables.Protocol {
return f.protocol
}
func saveChain(chain *fakeChain, data *bytes.Buffer) {

2
pkg/kubelet/dockershim/network/hostport/hostport.go
View File

@ -137,7 +137,7 @@ func ensureKubeHostportChains(iptables utiliptables.Interface, natInterfaceName
if natInterfaceName != "" && natInterfaceName != "lo" {
// Need to SNAT traffic from localhost
localhost := "127.0.0.0/8"
if iptables.IsIpv6() {
if iptables.IsIPv6() {
localhost = "::1/128"
}
args = []string{"-m", "comment", "--comment", "SNAT for localhost access to hostports", "-o", natInterfaceName, "-s", localhost, "-j", "MASQUERADE"}

10
pkg/kubelet/dockershim/network/hostport/hostport_manager.go
View File

@ -88,10 +88,10 @@ func (hm *hostportManager) Add(id string, podPortMapping *PodPortMapping, natInt
return fmt.Errorf("invalid or missing IP of pod %s", podFullName)
}
podIP := podPortMapping.IP.String()
isIpv6 := utilnet.IsIPv6(podPortMapping.IP)
isIPv6 := utilnet.IsIPv6(podPortMapping.IP)
if isIpv6 != hm.iptables.IsIpv6() {
return fmt.Errorf("HostPortManager IP family mismatch: %v, isIPv6 - %v", podIP, isIpv6)
if isIPv6 != hm.iptables.IsIPv6() {
return fmt.Errorf("HostPortManager IP family mismatch: %v, isIPv6 - %v", podIP, isIPv6)
}
if err = ensureKubeHostportChains(hm.iptables, natInterfaceName); err != nil {
@ -180,9 +180,9 @@ func (hm *hostportManager) Add(id string, podPortMapping *PodPortMapping, natInt
// create a new conntrack entry without any DNAT. That will result in blackhole of the traffic even after correct
// iptables rules have been added back.
if hm.execer != nil && hm.conntrackFound {
klog.Infof("Starting to delete udp conntrack entries: %v, isIPv6 - %v", conntrackPortsToRemove, isIpv6)
klog.Infof("Starting to delete udp conntrack entries: %v, isIPv6 - %v", conntrackPortsToRemove, isIPv6)
for _, port := range conntrackPortsToRemove {
err = conntrack.ClearEntriesForPort(hm.execer, port, isIpv6, v1.ProtocolUDP)
err = conntrack.ClearEntriesForPort(hm.execer, port, isIPv6, v1.ProtocolUDP)
if err != nil {
klog.Errorf("Failed to clear udp conntrack for port %d, error: %v", port, err)
}

2
pkg/kubelet/dockershim/network/hostport/hostport_manager_test.go
View File

@ -387,7 +387,7 @@ func TestGetHostportChain(t *testing.T) {
func TestHostportManagerIPv6(t *testing.T) {
iptables := NewFakeIPTables()
iptables.ipv6 = true
iptables.protocol = utiliptables.ProtocolIPv6
portOpener := NewFakeSocketManager()
manager := &hostportManager{
hostPortMap: make(map[hostport]closeable),

2
pkg/kubelet/dockershim/network/hostport/hostport_syncer.go
View File

@ -199,7 +199,7 @@ func (h *hostportSyncer) SyncHostports(natInterfaceName string, activePodPortMap
klog.V(4).Infof("syncHostportsRules took %v", time.Since(start))
}()
hostportPodMap, err := gatherAllHostports(activePodPortMappings, h.iptables.IsIpv6())
hostportPodMap, err := gatherAllHostports(activePodPortMappings, h.iptables.IsIPv6())
if err != nil {
return err
}

2
pkg/kubelet/dockershim/network/hostport/hostport_syncer_test.go
View File

@ -244,7 +244,7 @@ func matchRule(chain *fakeChain, match string) bool {
func TestOpenPodHostportsIPv6(t *testing.T) {
fakeIPTables := NewFakeIPTables()
fakeIPTables.ipv6 = true
fakeIPTables.protocol = utiliptables.ProtocolIPv6
fakeOpener := NewFakeSocketManager()
h := &hostportSyncer{

4
pkg/kubelet/dockershim/network/kubenet/kubenet_linux.go
View File

@ -122,8 +122,8 @@ type kubenetNetworkPlugin struct {
func NewPlugin(networkPluginDirs []string, cacheDir string) network.NetworkPlugin {
execer := utilexec.New()
iptInterface := utiliptables.New(execer, utiliptables.ProtocolIpv4)
iptInterfacev6 := utiliptables.New(execer, utiliptables.ProtocolIpv6)
iptInterface := utiliptables.New(execer, utiliptables.ProtocolIPv4)
iptInterfacev6 := utiliptables.New(execer, utiliptables.ProtocolIPv6)
return &kubenetNetworkPlugin{
podIPs: make(map[kubecontainer.ContainerID]utilsets.String),
execer: utilexec.New(),

4
pkg/kubelet/kubelet.go
View File

@ -523,10 +523,10 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration,
}
httpClient := &http.Client{}
parsedNodeIP := net.ParseIP(nodeIP)
protocol := utilipt.ProtocolIpv4
protocol := utilipt.ProtocolIPv4
if utilnet.IsIPv6(parsedNodeIP) {
klog.V(0).Infof("IPv6 node IP (%s), assume IPv6 operation", nodeIP)
protocol = utilipt.ProtocolIpv6
protocol = utilipt.ProtocolIPv6
}
klet := &Kubelet{

4
pkg/proxy/endpoints.go
View File

@ -176,6 +176,10 @@ func (ect *EndpointChangeTracker) Update(previous, current *v1.Endpoints) bool {
// there will be no network programming for them and thus no network programming latency metric
// should be exported.
delete(ect.lastChangeTriggerTimes, namespacedName)
} else {
for spn, eps := range change.current {
klog.V(2).Infof("Service port %s updated: %d endpoints", spn, len(eps))
}
}
metrics.EndpointChangesPending.Set(float64(len(ect.items)))

27
pkg/proxy/iptables/proxier.go
View File

@ -269,10 +269,8 @@ func NewProxier(ipt utiliptables.Interface,
nodePortAddresses []string,
) (*Proxier, error) {
// Set the route_localnet sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlRouteLocalnet); val != 1 {
if err := sysctl.SetSysctl(sysctlRouteLocalnet, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlRouteLocalnet, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlRouteLocalnet, 1); err != nil {
return nil, err
}
// Proxy needs br_netfilter and bridge-nf-call-iptables=1 when containers
@ -285,12 +283,13 @@ func NewProxier(ipt utiliptables.Interface,
// Generate the masquerade mark to use for SNAT rules.
masqueradeValue := 1 << uint(masqueradeBit)
masqueradeMark := fmt.Sprintf("%#08x/%#08x", masqueradeValue, masqueradeValue)
klog.V(2).Infof("iptables(%s) masquerade mark: %s", ipt.Protocol(), masqueradeMark)
endpointSlicesEnabled := utilfeature.DefaultFeatureGate.Enabled(features.EndpointSliceProxying)
serviceHealthServer := healthcheck.NewServiceHealthServer(hostname, recorder)
isIPv6 := ipt.IsIpv6()
isIPv6 := ipt.IsIPv6()
proxier := &Proxier{
portsMap: make(map[utilproxy.LocalPort]utilproxy.Closeable),
serviceMap: make(proxy.ServiceMap),
@ -319,15 +318,25 @@ func NewProxier(ipt utiliptables.Interface,
nodePortAddresses: nodePortAddresses,
networkInterfacer: utilproxy.RealNetwork{},
}
burstSyncs := 2
klog.V(3).Infof("minSyncPeriod: %v, syncPeriod: %v, burstSyncs: %d", minSyncPeriod, syncPeriod, burstSyncs)
klog.V(2).Infof("iptables(%s) sync params: minSyncPeriod=%v, syncPeriod=%v, burstSyncs=%d",
ipt.Protocol(), minSyncPeriod, syncPeriod, burstSyncs)
// We pass syncPeriod to ipt.Monitor, which will call us only if it needs to.
// We need to pass *some* maxInterval to NewBoundedFrequencyRunner anyway though.
// time.Hour is arbitrary.
proxier.syncRunner = async.NewBoundedFrequencyRunner("sync-runner", proxier.syncProxyRules, minSyncPeriod, time.Hour, burstSyncs)
go ipt.Monitor(utiliptables.Chain("KUBE-PROXY-CANARY"),
[]utiliptables.Table{utiliptables.TableMangle, utiliptables.TableNAT, utiliptables.TableFilter},
proxier.syncProxyRules, syncPeriod, wait.NeverStop)
if ipt.HasRandomFully() {
klog.V(2).Infof("iptables(%s) supports --random-fully", ipt.Protocol())
} else {
klog.V(2).Infof("iptables(%s) does not support --random-fully", ipt.Protocol())
}
return proxier, nil
}
@ -787,7 +796,7 @@ func (proxier *Proxier) syncProxyRules() {
start := time.Now()
defer func() {
metrics.SyncProxyRulesLatency.Observe(metrics.SinceInSeconds(start))
klog.V(4).Infof("syncProxyRules took %v", time.Since(start))
klog.V(2).Infof("syncProxyRules took %v", time.Since(start))
}()
localAddrs, err := utilproxy.GetLocalAddrs()
@ -818,7 +827,7 @@ func (proxier *Proxier) syncProxyRules() {
}
}
klog.V(3).Info("Syncing iptables rules")
klog.V(2).Info("Syncing iptables rules")
success := false
defer func() {
@ -1459,7 +1468,7 @@ func (proxier *Proxier) syncProxyRules() {
if err != nil {
klog.Errorf("Failed to get node ip address matching nodeport cidr")
} else {
isIPv6 := proxier.iptables.IsIpv6()
isIPv6 := proxier.iptables.IsIPv6()
for address := range addresses {
// TODO(thockin, m1093782566): If/when we have dual-stack support we will want to distinguish v4 from v6 zero-CIDRs.
if utilproxy.IsZeroCIDR(address) {

30
pkg/proxy/iptables/proxier_test.go
View File

@ -2427,23 +2427,23 @@ COMMIT
:KUBE-NODEPORTS - [0:0]
:KUBE-POSTROUTING - [0:0]
:KUBE-MARK-MASQ - [0:0]
:KUBE-SVC-AHZNAGK3SCETOS2T - [0:0]
:KUBE-SEP-PXD6POUVGD2I37UY - [0:0]
:KUBE-SEP-SOKZUIT7SCEVIP33 - [0:0]
:KUBE-SEP-WVE3FAB34S7NZGDJ - [0:0]
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
:KUBE-SEP-3JOIVZTXZZRGORX4 - [0:0]
:KUBE-SEP-IO5XOSKPAXIFQXAJ - [0:0]
:KUBE-SEP-XGJFVO3L2O5SRFNT - [0:0]
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -m mark --mark -j MASQUERADE
-A KUBE-MARK-MASQ -j MARK --set-xmark
-A KUBE-SERVICES -m comment --comment "ns1/svc1: cluster IP" -m tcp -p tcp -d 172.20.1.1/32 --dport 0 ! -s 10.0.0.0/24 -j KUBE-MARK-MASQ
-A KUBE-SERVICES -m comment --comment "ns1/svc1: cluster IP" -m tcp -p tcp -d 172.20.1.1/32 --dport 0 -j KUBE-SVC-AHZNAGK3SCETOS2T
-A KUBE-SVC-AHZNAGK3SCETOS2T -m comment --comment ns1/svc1: -m statistic --mode random --probability 0.3333333333 -j KUBE-SEP-PXD6POUVGD2I37UY
-A KUBE-SEP-PXD6POUVGD2I37UY -m comment --comment ns1/svc1: -s 10.0.1.1/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-PXD6POUVGD2I37UY -m comment --comment ns1/svc1: -m tcp -p tcp -j DNAT --to-destination 10.0.1.1:80
-A KUBE-SVC-AHZNAGK3SCETOS2T -m comment --comment ns1/svc1: -m statistic --mode random --probability 0.5000000000 -j KUBE-SEP-SOKZUIT7SCEVIP33
-A KUBE-SEP-SOKZUIT7SCEVIP33 -m comment --comment ns1/svc1: -s 10.0.1.2/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-SOKZUIT7SCEVIP33 -m comment --comment ns1/svc1: -m tcp -p tcp -j DNAT --to-destination 10.0.1.2:80
-A KUBE-SVC-AHZNAGK3SCETOS2T -m comment --comment ns1/svc1: -j KUBE-SEP-WVE3FAB34S7NZGDJ
-A KUBE-SEP-WVE3FAB34S7NZGDJ -m comment --comment ns1/svc1: -s 10.0.1.3/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-WVE3FAB34S7NZGDJ -m comment --comment ns1/svc1: -m tcp -p tcp -j DNAT --to-destination 10.0.1.3:80
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.20.1.1/32 --dport 0 ! -s 10.0.0.0/24 -j KUBE-MARK-MASQ
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.20.1.1/32 --dport 0 -j KUBE-SVC-AQI2S6QIMU7PVVRP
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.3333333333 -j KUBE-SEP-3JOIVZTXZZRGORX4
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -s 10.0.1.1/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -m tcp -p tcp -j DNAT --to-destination 10.0.1.1:80
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.5000000000 -j KUBE-SEP-IO5XOSKPAXIFQXAJ
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -s 10.0.1.2/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -m tcp -p tcp -j DNAT --to-destination 10.0.1.2:80
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -j KUBE-SEP-XGJFVO3L2O5SRFNT
-A KUBE-SEP-XGJFVO3L2O5SRFNT -m comment --comment ns1/svc1 -s 10.0.1.3/32 -j KUBE-MARK-MASQ
-A KUBE-SEP-XGJFVO3L2O5SRFNT -m comment --comment ns1/svc1 -m tcp -p tcp -j DNAT --to-destination 10.0.1.3:80
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
COMMIT
`

57
pkg/proxy/ipvs/proxier.go
View File

@ -347,10 +347,8 @@ func NewProxier(ipt utiliptables.Interface,
kernelHandler KernelHandler,
) (*Proxier, error) {
// Set the route_localnet sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlRouteLocalnet); val != 1 {
if err := sysctl.SetSysctl(sysctlRouteLocalnet, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlRouteLocalnet, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlRouteLocalnet, 1); err != nil {
return nil, err
}
// Proxy needs br_netfilter and bridge-nf-call-iptables=1 when containers
@ -361,10 +359,8 @@ func NewProxier(ipt utiliptables.Interface,
}
// Set the conntrack sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlVSConnTrack); val != 1 {
if err := sysctl.SetSysctl(sysctlVSConnTrack, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlVSConnTrack, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlVSConnTrack, 1); err != nil {
return nil, err
}
kernelVersionStr, err := kernelHandler.GetKernelVersion()
@ -379,47 +375,35 @@ func NewProxier(ipt utiliptables.Interface,
klog.Errorf("can't set sysctl %s, kernel version must be at least %s", sysctlConnReuse, connReuseMinSupportedKernelVersion)
} else {
// Set the connection reuse mode
if val, _ := sysctl.GetSysctl(sysctlConnReuse); val != 0 {
if err := sysctl.SetSysctl(sysctlConnReuse, 0); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlConnReuse, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlConnReuse, 0); err != nil {
return nil, err
}
}
// Set the expire_nodest_conn sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlExpireNoDestConn); val != 1 {
if err := sysctl.SetSysctl(sysctlExpireNoDestConn, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlExpireNoDestConn, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlExpireNoDestConn, 1); err != nil {
return nil, err
}
// Set the expire_quiescent_template sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlExpireQuiescentTemplate); val != 1 {
if err := sysctl.SetSysctl(sysctlExpireQuiescentTemplate, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlExpireQuiescentTemplate, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlExpireQuiescentTemplate, 1); err != nil {
return nil, err
}
// Set the ip_forward sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlForward); val != 1 {
if err := sysctl.SetSysctl(sysctlForward, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlForward, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlForward, 1); err != nil {
return nil, err
}
if strictARP {
// Set the arp_ignore sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlArpIgnore); val != 1 {
if err := sysctl.SetSysctl(sysctlArpIgnore, 1); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlArpIgnore, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlArpIgnore, 1); err != nil {
return nil, err
}
// Set the arp_announce sysctl we need for
if val, _ := sysctl.GetSysctl(sysctlArpAnnounce); val != 2 {
if err := sysctl.SetSysctl(sysctlArpAnnounce, 2); err != nil {
return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlArpAnnounce, err)
}
if err := utilproxy.EnsureSysctl(sysctl, sysctlArpAnnounce, 2); err != nil {
return nil, err
}
}
@ -490,7 +474,8 @@ func NewProxier(ipt utiliptables.Interface,
proxier.ipsetList[is.name] = NewIPSet(ipset, is.name, is.setType, isIPv6, is.comment)
}
burstSyncs := 2
klog.V(3).Infof("minSyncPeriod: %v, syncPeriod: %v, burstSyncs: %d", minSyncPeriod, syncPeriod, burstSyncs)
klog.V(2).Infof("ipvs(%s) sync params: minSyncPeriod=%v, syncPeriod=%v, burstSyncs=%d",
ipt.Protocol(), minSyncPeriod, syncPeriod, burstSyncs)
proxier.syncRunner = async.NewBoundedFrequencyRunner("sync-runner", proxier.syncProxyRules, minSyncPeriod, syncPeriod, burstSyncs)
proxier.gracefuldeleteManager.Run()
return proxier, nil
@ -2103,10 +2088,10 @@ func (proxier *Proxier) isIPInExcludeCIDRs(ip net.IP) bool {
func (proxier *Proxier) getLegacyBindAddr(activeBindAddrs map[string]bool, currentBindAddrs []string) map[string]bool {
legacyAddrs := make(map[string]bool)
isIpv6 := utilnet.IsIPv6(proxier.nodeIP)
isIPv6 := utilnet.IsIPv6(proxier.nodeIP)
for _, addr := range currentBindAddrs {
addrIsIpv6 := utilnet.IsIPv6(net.ParseIP(addr))
if addrIsIpv6 && !isIpv6 || !addrIsIpv6 && isIpv6 {
addrIsIPv6 := utilnet.IsIPv6(net.ParseIP(addr))
if addrIsIPv6 && !isIPv6 || !addrIsIPv6 && isIPv6 {
continue
}
if _, ok := activeBindAddrs[addr]; !ok {

2
pkg/proxy/service.go
View File

@ -263,6 +263,8 @@ func (sct *ServiceChangeTracker) Update(previous, current *v1.Service) bool {
// if change.previous equal to change.current, it means no change
if reflect.DeepEqual(change.previous, change.current) {
delete(sct.items, namespacedName)
} else {
klog.V(2).Infof("Service %s updated: %d ports", namespacedName, len(change.current))
}
metrics.ServiceChangesPending.Set(float64(len(sct.items)))
return len(sct.items) > 0

9
pkg/proxy/types.go
View File

@ -49,7 +49,14 @@ type ServicePortName struct {
}
func (spn ServicePortName) String() string {
return fmt.Sprintf("%s:%s", spn.NamespacedName.String(), spn.Port)
return fmt.Sprintf("%s%s", spn.NamespacedName.String(), fmtPortName(spn.Port))
}
func fmtPortName(in string) string {
if in == "" {
return ""
}
return fmt.Sprintf(":%s", in)
}
// ServicePort is an interface which abstracts information about a service.

1
pkg/proxy/util/BUILD
View File

@ -12,6 +12,7 @@ go_library(
visibility = ["//visibility:public"],
deps = [
"//pkg/apis/core/v1/helper:go_default_library",
"//pkg/util/sysctl:go_default_library",
"//staging/src/k8s.io/api/core/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/rand:go_default_library",

4
pkg/proxy/util/iptables/traffic.go
View File

@ -66,8 +66,8 @@ type detectLocalByCIDR struct {
// NewDetectLocalByCIDR implements the LocalTrafficDetector interface using a CIDR. This can be used when a single CIDR
// range can be used to capture the notion of local traffic.
func NewDetectLocalByCIDR(cidr string, ipt utiliptables.Interface) (LocalTrafficDetector, error) {
if utilnet.IsIPv6CIDRString(cidr) != ipt.IsIpv6() {
return nil, fmt.Errorf("CIDR %s has incorrect IP version: expect isIPv6=%t", cidr, ipt.IsIpv6())
if utilnet.IsIPv6CIDRString(cidr) != ipt.IsIPv6() {
return nil, fmt.Errorf("CIDR %s has incorrect IP version: expect isIPv6=%t", cidr, ipt.IsIPv6())
}
_, _, err := net.ParseCIDR(cidr)
if err != nil {

10
pkg/proxy/util/iptables/traffic_test.go
View File

@ -70,12 +70,12 @@ func TestNewDetectLocalByCIDR(t *testing.T) {
},
{
cidr: "2002::1234:abcd:ffff:c0a8:101/64",
ipt: iptablestest.NewIpv6Fake(),
ipt: iptablestest.NewIPv6Fake(),
errExpected: false,
},
{
cidr: "10.0.0.0/14",
ipt: iptablestest.NewIpv6Fake(),
ipt: iptablestest.NewIPv6Fake(),
errExpected: true,
},
{
@ -90,7 +90,7 @@ func TestNewDetectLocalByCIDR(t *testing.T) {
},
{
cidr: "2002::1234:abcd:ffff:c0a8:101",
ipt: iptablestest.NewIpv6Fake(),
ipt: iptablestest.NewIPv6Fake(),
errExpected: true,
},
{
@ -100,7 +100,7 @@ func TestNewDetectLocalByCIDR(t *testing.T) {
},
{
cidr: "",
ipt: iptablestest.NewIpv6Fake(),
ipt: iptablestest.NewIPv6Fake(),
errExpected: true,
},
}
@ -137,7 +137,7 @@ func TestDetectLocalByCIDR(t *testing.T) {
},
{
cidr: "2002::1234:abcd:ffff:c0a8:101/64",
ipt: iptablestest.NewIpv6Fake(),
ipt: iptablestest.NewIPv6Fake(),
chain: "TEST",
args: []string{"arg1", "arg2"},
expectedJumpIfOutput: []string{"arg1", "arg2", "-s", "2002::1234:abcd:ffff:c0a8:101/64", "-j", "TEST"},

12
pkg/proxy/util/utils.go
View File

@ -29,6 +29,7 @@ import (
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/client-go/tools/record"
helper "k8s.io/kubernetes/pkg/apis/core/v1/helper"
utilsysctl "k8s.io/kubernetes/pkg/util/sysctl"
utilnet "k8s.io/utils/net"
"k8s.io/klog"
@ -288,3 +289,14 @@ func ShuffleStrings(s []string) []string {
}
return shuffled
}
// EnsureSysctl sets a kernel sysctl to a given numeric value.
func EnsureSysctl(sysctl utilsysctl.Interface, name string, newVal int) error {
if oldVal, _ := sysctl.GetSysctl(name); oldVal != newVal {
if err := sysctl.SetSysctl(name, newVal); err != nil {
return fmt.Errorf("can't set sysctl %s to %d: %v", name, newVal, err)
}
klog.V(1).Infof("Changed sysctl %q: %d -> %d", name, oldVal, newVal)
}
return nil
}

8
pkg/proxy/winuserspace/proxier.go
View File

@ -213,7 +213,7 @@ func (proxier *Proxier) addServicePortPortal(servicePortPortalName ServicePortPo
return nil, fmt.Errorf("could not parse ip '%q'", listenIP)
}
// add the IP address. Node port binds to all interfaces.
args := proxier.netshIpv4AddressAddArgs(serviceIP)
args := proxier.netshIPv4AddressAddArgs(serviceIP)
if existed, err := proxier.netsh.EnsureIPAddress(args, serviceIP); err != nil {
return nil, err
} else if !existed {
@ -262,7 +262,7 @@ func (proxier *Proxier) closeServicePortPortal(servicePortPortalName ServicePort
// close the PortalProxy by deleting the service IP address
if info.portal.ip != allAvailableInterfaces {
serviceIP := net.ParseIP(info.portal.ip)
args := proxier.netshIpv4AddressDeleteArgs(serviceIP)
args := proxier.netshIPv4AddressDeleteArgs(serviceIP)
if err := proxier.netsh.DeleteIPAddress(args); err != nil {
return err
}
@ -474,7 +474,7 @@ func isClosedError(err error) bool {
return strings.HasSuffix(err.Error(), "use of closed network connection")
}
func (proxier *Proxier) netshIpv4AddressAddArgs(destIP net.IP) []string {
func (proxier *Proxier) netshIPv4AddressAddArgs(destIP net.IP) []string {
intName := proxier.netsh.GetInterfaceToAddIP()
args := []string{
"interface", "ipv4", "add", "address",
@ -485,7 +485,7 @@ func (proxier *Proxier) netshIpv4AddressAddArgs(destIP net.IP) []string {
return args
}
func (proxier *Proxier) netshIpv4AddressDeleteArgs(destIP net.IP) []string {
func (proxier *Proxier) netshIPv4AddressDeleteArgs(destIP net.IP) []string {
intName := proxier.netsh.GetInterfaceToAddIP()
args := []string{
"interface", "ipv4", "delete", "address",

30
pkg/util/iptables/iptables.go
View File

@ -55,8 +55,10 @@ type Interface interface {
EnsureRule(position RulePosition, table Table, chain Chain, args ...string) (bool, error)
// DeleteRule checks if the specified rule is present and, if so, deletes it.
DeleteRule(table Table, chain Chain, args ...string) error
// IsIpv6 returns true if this is managing ipv6 tables
IsIpv6() bool
// IsIPv6 returns true if this is managing ipv6 tables.
IsIPv6() bool
// Protocol returns the IP family this instance is managing,
Protocol() Protocol
// SaveInto calls `iptables-save` for table and stores result in a given buffer.
SaveInto(table Table, buffer *bytes.Buffer) error
// Restore runs `iptables-restore` passing data through []byte.
@ -87,13 +89,13 @@ type Interface interface {
}
// Protocol defines the ip protocol either ipv4 or ipv6
type Protocol byte
type Protocol string
const (
// ProtocolIpv4 represents ipv4 protocol in iptables
ProtocolIpv4 Protocol = iota + 1
// ProtocolIpv6 represents ipv6 protocol in iptables
ProtocolIpv6
// ProtocolIPv4 represents ipv4 protocol in iptables
ProtocolIPv4 Protocol = "IPv4"
// ProtocolIPv6 represents ipv6 protocol in iptables
ProtocolIPv6 Protocol = "IPv6"
)
// Table represents different iptable like filter,nat, mangle and raw
@ -319,8 +321,12 @@ func (runner *runner) DeleteRule(table Table, chain Chain, args ...string) error
return nil
}
func (runner *runner) IsIpv6() bool {
return runner.protocol == ProtocolIpv6
func (runner *runner) IsIPv6() bool {
return runner.protocol == ProtocolIPv6
}
func (runner *runner) Protocol() Protocol {
return runner.protocol
}
// SaveInto is part of Interface.
@ -410,14 +416,14 @@ func (runner *runner) restoreInternal(args []string, data []byte, flush FlushFla
}
func iptablesSaveCommand(protocol Protocol) string {
if protocol == ProtocolIpv6 {
if protocol == ProtocolIPv6 {
return cmdIP6TablesSave
}
return cmdIPTablesSave
}
func iptablesRestoreCommand(protocol Protocol) string {
if protocol == ProtocolIpv6 {
if protocol == ProtocolIPv6 {
return cmdIP6TablesRestore
}
return cmdIPTablesRestore
@ -425,7 +431,7 @@ func iptablesRestoreCommand(protocol Protocol) string {
}
func iptablesCommand(protocol Protocol) string {
if protocol == ProtocolIpv6 {
if protocol == ProtocolIPv6 {
return cmdIP6Tables
}
return cmdIPTables

138
pkg/util/iptables/iptables_test.go
View File

@ -35,18 +35,10 @@ import (
const TestLockfilePath = "xtables.lock"
func protocolStr(protocol Protocol) string {
if protocol == ProtocolIpv4 {
return "IPv4"
}
return "IPv6"
}
func testIPTablesVersionCmds(t *testing.T, protocol Protocol) {
version := " v1.4.22"
iptablesCmd := iptablesCommand(protocol)
iptablesRestoreCmd := iptablesRestoreCommand(protocol)
protoStr := protocolStr(protocol)
fcmd := fakeexec.FakeCmd{
CombinedOutputScript: []fakeexec.FakeAction{
@ -66,26 +58,24 @@ func testIPTablesVersionCmds(t *testing.T, protocol Protocol) {
// Check that proper iptables version command was used during runner instantiation
if !sets.NewString(fcmd.CombinedOutputLog[0]...).HasAll(iptablesCmd, "--version") {
t.Errorf("%s runner instantiate: Expected cmd '%s --version', Got '%s'", protoStr, iptablesCmd, fcmd.CombinedOutputLog[0])
t.Errorf("%s runner instantiate: Expected cmd '%s --version', Got '%s'", protocol, iptablesCmd, fcmd.CombinedOutputLog[0])
}
// Check that proper iptables restore version command was used during runner instantiation
if !sets.NewString(fcmd.CombinedOutputLog[1]...).HasAll(iptablesRestoreCmd, "--version") {
t.Errorf("%s runner instantiate: Expected cmd '%s --version', Got '%s'", protoStr, iptablesRestoreCmd, fcmd.CombinedOutputLog[1])
t.Errorf("%s runner instantiate: Expected cmd '%s --version', Got '%s'", protocol, iptablesRestoreCmd, fcmd.CombinedOutputLog[1])
}
}
func TestIPTablesVersionCmdsIPv4(t *testing.T) {
testIPTablesVersionCmds(t, ProtocolIpv4)
testIPTablesVersionCmds(t, ProtocolIPv4)
}
func TestIPTablesVersionCmdsIPv6(t *testing.T) {
testIPTablesVersionCmds(t, ProtocolIpv6)
testIPTablesVersionCmds(t, ProtocolIPv6)
}
func testEnsureChain(t *testing.T, protocol Protocol) {
protoStr := protocolStr(protocol)
fcmd := fakeexec.FakeCmd{
CombinedOutputScript: []fakeexec.FakeAction{
// iptables version check
@ -110,39 +100,39 @@ func testEnsureChain(t *testing.T, protocol Protocol) {
// Success.
exists, err := runner.EnsureChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("%s new chain: Expected success, got %v", protoStr, err)
t.Errorf("%s new chain: Expected success, got %v", protocol, err)
}
if exists {
t.Errorf("%s new chain: Expected exists = false", protoStr)
t.Errorf("%s new chain: Expected exists = false", protocol)
}
if fcmd.CombinedOutputCalls != 2 {
t.Errorf("%s new chain: Expected 2 CombinedOutput() calls, got %d", protoStr, fcmd.CombinedOutputCalls)
t.Errorf("%s new chain: Expected 2 CombinedOutput() calls, got %d", protocol, fcmd.CombinedOutputCalls)
}
cmd := iptablesCommand(protocol)
if !sets.NewString(fcmd.CombinedOutputLog[1]...).HasAll(cmd, "-t", "nat", "-N", "FOOBAR") {
t.Errorf("%s new chain: Expected cmd containing '%s -t nat -N FOOBAR', got %s", protoStr, cmd, fcmd.CombinedOutputLog[2])
t.Errorf("%s new chain: Expected cmd containing '%s -t nat -N FOOBAR', got %s", protocol, cmd, fcmd.CombinedOutputLog[2])
}
// Exists.
exists, err = runner.EnsureChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("%s existing chain: Expected success, got %v", protoStr, err)
t.Errorf("%s existing chain: Expected success, got %v", protocol, err)
}
if !exists {
t.Errorf("%s existing chain: Expected exists = true", protoStr)
t.Errorf("%s existing chain: Expected exists = true", protocol)
}
// Simulate failure.
_, err = runner.EnsureChain(TableNAT, Chain("FOOBAR"))
if err == nil {
t.Errorf("%s: Expected failure", protoStr)
t.Errorf("%s: Expected failure", protocol)
}
}
func TestEnsureChainIpv4(t *testing.T) {
testEnsureChain(t, ProtocolIpv4)
func TestEnsureChainIPv4(t *testing.T) {
testEnsureChain(t, ProtocolIPv4)
}
func TestEnsureChainIpv6(t *testing.T) {
testEnsureChain(t, ProtocolIpv6)
func TestEnsureChainIPv6(t *testing.T) {
testEnsureChain(t, ProtocolIPv6)
}
func TestFlushChain(t *testing.T) {
@ -163,7 +153,7 @@ func TestFlushChain(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
// Success.
err := runner.FlushChain(TableNAT, Chain("FOOBAR"))
if err != nil {
@ -200,7 +190,7 @@ func TestDeleteChain(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
// Success.
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
@ -236,7 +226,7 @@ func TestEnsureRuleAlreadyExists(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
exists, err := runner.EnsureRule(Append, TableNAT, ChainOutput, "abc", "123")
if err != nil {
t.Errorf("expected success, got %v", err)
@ -272,7 +262,7 @@ func TestEnsureRuleNew(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
exists, err := runner.EnsureRule(Append, TableNAT, ChainOutput, "abc", "123")
if err != nil {
t.Errorf("expected success, got %v", err)
@ -305,7 +295,7 @@ func TestEnsureRuleErrorChecking(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
_, err := runner.EnsureRule(Append, TableNAT, ChainOutput, "abc", "123")
if err == nil {
t.Errorf("expected failure")
@ -335,7 +325,7 @@ func TestEnsureRuleErrorCreating(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
_, err := runner.EnsureRule(Append, TableNAT, ChainOutput, "abc", "123")
if err == nil {
t.Errorf("expected failure")
@ -362,7 +352,7 @@ func TestDeleteRuleDoesNotExist(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteRule(TableNAT, ChainOutput, "abc", "123")
if err != nil {
t.Errorf("expected success, got %v", err)
@ -395,7 +385,7 @@ func TestDeleteRuleExists(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteRule(TableNAT, ChainOutput, "abc", "123")
if err != nil {
t.Errorf("expected success, got %v", err)
@ -425,7 +415,7 @@ func TestDeleteRuleErrorChecking(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteRule(TableNAT, ChainOutput, "abc", "123")
if err == nil {
t.Errorf("expected failure")
@ -455,7 +445,7 @@ func TestDeleteRuleErrorDeleting(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteRule(TableNAT, ChainOutput, "abc", "123")
if err == nil {
t.Errorf("expected failure")
@ -490,7 +480,7 @@ func TestGetIPTablesHasCheckCommand(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
ipt := New(&fexec, ProtocolIpv4)
ipt := New(&fexec, ProtocolIPv4)
runner := ipt.(*runner)
if testCase.Expected != runner.hasCheck {
t.Errorf("Expected result: %v, Got result: %v", testCase.Expected, runner.hasCheck)
@ -504,12 +494,12 @@ func TestIPTablesCommands(t *testing.T) {
protocol Protocol
expectedCmd string
}{
{"iptablesCommand", ProtocolIpv4, cmdIPTables},
{"iptablesCommand", ProtocolIpv6, cmdIP6Tables},
{"iptablesSaveCommand", ProtocolIpv4, cmdIPTablesSave},
{"iptablesSaveCommand", ProtocolIpv6, cmdIP6TablesSave},
{"iptablesRestoreCommand", ProtocolIpv4, cmdIPTablesRestore},
{"iptablesRestoreCommand", ProtocolIpv6, cmdIP6TablesRestore},
{"iptablesCommand", ProtocolIPv4, cmdIPTables},
{"iptablesCommand", ProtocolIPv6, cmdIP6Tables},
{"iptablesSaveCommand", ProtocolIPv4, cmdIPTablesSave},
{"iptablesSaveCommand", ProtocolIPv6, cmdIP6TablesSave},
{"iptablesRestoreCommand", ProtocolIPv4, cmdIPTablesRestore},
{"iptablesRestoreCommand", ProtocolIPv6, cmdIP6TablesRestore},
}
for _, testCase := range testCases {
var cmd string
@ -651,7 +641,7 @@ func TestWaitFlagUnavailable(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("expected success, got %v", err)
@ -682,7 +672,7 @@ func TestWaitFlagOld(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("expected success, got %v", err)
@ -716,7 +706,7 @@ func TestWaitFlagNew(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("expected success, got %v", err)
@ -747,7 +737,7 @@ func TestWaitIntervalFlagNew(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
runner := New(&fexec, ProtocolIPv4)
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("expected success, got %v", err)
@ -764,7 +754,6 @@ func testSaveInto(t *testing.T, protocol Protocol) {
version := " v1.9.22"
iptablesCmd := iptablesCommand(protocol)
iptablesSaveCmd := iptablesSaveCommand(protocol)
protoStr := protocolStr(protocol)
output := fmt.Sprintf(`# Generated by %s on Thu Jan 19 11:38:09 2017
*filter
@ -799,47 +788,46 @@ COMMIT
// Success.
err := runner.SaveInto(TableNAT, buffer)
if err != nil {
t.Fatalf("%s: Expected success, got %v", protoStr, err)
t.Fatalf("%s: Expected success, got %v", protocol, err)
}
if string(buffer.Bytes()) != output {
t.Errorf("%s: Expected output '%s', got '%v'", protoStr, output, string(buffer.Bytes()))
t.Errorf("%s: Expected output '%s', got '%v'", protocol, output, string(buffer.Bytes()))
}
if fcmd.CombinedOutputCalls != 1 {
t.Errorf("%s: Expected 1 CombinedOutput() calls, got %d", protoStr, fcmd.CombinedOutputCalls)
t.Errorf("%s: Expected 1 CombinedOutput() calls, got %d", protocol, fcmd.CombinedOutputCalls)
}
if fcmd.RunCalls != 1 {
t.Errorf("%s: Expected 1 Run() call, got %d", protoStr, fcmd.RunCalls)
t.Errorf("%s: Expected 1 Run() call, got %d", protocol, fcmd.RunCalls)
}
if !sets.NewString(fcmd.RunLog[0]...).HasAll(iptablesSaveCmd, "-t", "nat") {
t.Errorf("%s: Expected cmd containing '%s -t nat', got '%s'", protoStr, iptablesSaveCmd, fcmd.RunLog[0])
t.Errorf("%s: Expected cmd containing '%s -t nat', got '%s'", protocol, iptablesSaveCmd, fcmd.RunLog[0])
}
// Failure.
buffer.Reset()
err = runner.SaveInto(TableNAT, buffer)
if err == nil {
t.Errorf("%s: Expected failure", protoStr)
t.Errorf("%s: Expected failure", protocol)
}
if string(buffer.Bytes()) != stderrOutput {
t.Errorf("%s: Expected output '%s', got '%v'", protoStr, stderrOutput, string(buffer.Bytes()))
t.Errorf("%s: Expected output '%s', got '%v'", protocol, stderrOutput, string(buffer.Bytes()))
}
}
func TestSaveIntoIPv4(t *testing.T) {
testSaveInto(t, ProtocolIpv4)
testSaveInto(t, ProtocolIPv4)
}
func TestSaveIntoIPv6(t *testing.T) {
testSaveInto(t, ProtocolIpv6)
testSaveInto(t, ProtocolIPv6)
}
func testRestore(t *testing.T, protocol Protocol) {
version := " v1.9.22"
iptablesCmd := iptablesCommand(protocol)
iptablesRestoreCmd := iptablesRestoreCommand(protocol)
protoStr := protocolStr(protocol)
fcmd := fakeexec.FakeCmd{
CombinedOutputScript: []fakeexec.FakeAction{
@ -867,64 +855,64 @@ func testRestore(t *testing.T, protocol Protocol) {
// both flags true
err := runner.Restore(TableNAT, []byte{}, FlushTables, RestoreCounters)
if err != nil {
t.Errorf("%s flush,restore: Expected success, got %v", protoStr, err)
t.Errorf("%s flush,restore: Expected success, got %v", protocol, err)
}
commandSet := sets.NewString(fcmd.CombinedOutputLog[1]...)
if !commandSet.HasAll(iptablesRestoreCmd, "-T", string(TableNAT), "--counters") || commandSet.HasAny("--noflush") {
t.Errorf("%s flush, restore: Expected cmd containing '%s -T %s --counters', got '%s'", protoStr, iptablesRestoreCmd, string(TableNAT), fcmd.CombinedOutputLog[1])
t.Errorf("%s flush, restore: Expected cmd containing '%s -T %s --counters', got '%s'", protocol, iptablesRestoreCmd, string(TableNAT), fcmd.CombinedOutputLog[1])
}
// FlushTables, NoRestoreCounters
err = runner.Restore(TableNAT, []byte{}, FlushTables, NoRestoreCounters)
if err != nil {
t.Errorf("%s flush, no restore: Expected success, got %v", protoStr, err)
t.Errorf("%s flush, no restore: Expected success, got %v", protocol, err)
}
commandSet = sets.NewString(fcmd.CombinedOutputLog[2]...)
if !commandSet.HasAll(iptablesRestoreCmd, "-T", string(TableNAT)) || commandSet.HasAny("--noflush", "--counters") {
t.Errorf("%s flush, no restore: Expected cmd containing '--noflush' or '--counters', got '%s'", protoStr, fcmd.CombinedOutputLog[2])
t.Errorf("%s flush, no restore: Expected cmd containing '--noflush' or '--counters', got '%s'", protocol, fcmd.CombinedOutputLog[2])
}
// NoFlushTables, RestoreCounters
err = runner.Restore(TableNAT, []byte{}, NoFlushTables, RestoreCounters)
if err != nil {
t.Errorf("%s no flush, restore: Expected success, got %v", protoStr, err)
t.Errorf("%s no flush, restore: Expected success, got %v", protocol, err)
}
commandSet = sets.NewString(fcmd.CombinedOutputLog[3]...)
if !commandSet.HasAll(iptablesRestoreCmd, "-T", string(TableNAT), "--noflush", "--counters") {
t.Errorf("%s no flush, restore: Expected cmd containing '--noflush' and '--counters', got '%s'", protoStr, fcmd.CombinedOutputLog[3])
t.Errorf("%s no flush, restore: Expected cmd containing '--noflush' and '--counters', got '%s'", protocol, fcmd.CombinedOutputLog[3])
}
// NoFlushTables, NoRestoreCounters
err = runner.Restore(TableNAT, []byte{}, NoFlushTables, NoRestoreCounters)
if err != nil {
t.Errorf("%s no flush, no restore: Expected success, got %v", protoStr, err)
t.Errorf("%s no flush, no restore: Expected success, got %v", protocol, err)
}
commandSet = sets.NewString(fcmd.CombinedOutputLog[4]...)
if !commandSet.HasAll(iptablesRestoreCmd, "-T", string(TableNAT), "--noflush") || commandSet.HasAny("--counters") {
t.Errorf("%s no flush, no restore: Expected cmd containing '%s -T %s --noflush', got '%s'", protoStr, iptablesRestoreCmd, string(TableNAT), fcmd.CombinedOutputLog[4])
t.Errorf("%s no flush, no restore: Expected cmd containing '%s -T %s --noflush', got '%s'", protocol, iptablesRestoreCmd, string(TableNAT), fcmd.CombinedOutputLog[4])
}
if fcmd.CombinedOutputCalls != 5 {
t.Errorf("%s: Expected 5 total CombinedOutput() calls, got %d", protoStr, fcmd.CombinedOutputCalls)
t.Errorf("%s: Expected 5 total CombinedOutput() calls, got %d", protocol, fcmd.CombinedOutputCalls)
}
// Failure.
err = runner.Restore(TableNAT, []byte{}, FlushTables, RestoreCounters)
if err == nil {
t.Errorf("%s Expected a failure", protoStr)
t.Errorf("%s Expected a failure", protocol)
}
}
func TestRestoreIPv4(t *testing.T) {
testRestore(t, ProtocolIpv4)
testRestore(t, ProtocolIPv4)
}
func TestRestoreIPv6(t *testing.T) {
testRestore(t, ProtocolIpv6)
testRestore(t, ProtocolIPv6)
}
// TestRestoreAll tests only the simplest use case, as flag handling code is already tested in TestRestore
@ -944,7 +932,7 @@ func TestRestoreAll(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := newInternal(&fexec, ProtocolIpv4, TestLockfilePath)
runner := newInternal(&fexec, ProtocolIPv4, TestLockfilePath)
defer os.Remove(TestLockfilePath)
err := runner.RestoreAll([]byte{}, NoFlushTables, RestoreCounters)
@ -985,7 +973,7 @@ func TestRestoreAllWait(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := newInternal(&fexec, ProtocolIpv4, TestLockfilePath)
runner := newInternal(&fexec, ProtocolIPv4, TestLockfilePath)
defer os.Remove(TestLockfilePath)
err := runner.RestoreAll([]byte{}, NoFlushTables, RestoreCounters)
@ -1030,7 +1018,7 @@ func TestRestoreAllWaitOldIptablesRestore(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := newInternal(&fexec, ProtocolIpv4, TestLockfilePath)
runner := newInternal(&fexec, ProtocolIPv4, TestLockfilePath)
defer os.Remove(TestLockfilePath)
err := runner.RestoreAll([]byte{}, NoFlushTables, RestoreCounters)
@ -1076,7 +1064,7 @@ func TestRestoreAllGrabNewLock(t *testing.T) {
},
}
runner := newInternal(&fexec, ProtocolIpv4, TestLockfilePath)
runner := newInternal(&fexec, ProtocolIPv4, TestLockfilePath)
defer os.Remove(TestLockfilePath)
// Grab the /run lock and ensure the RestoreAll fails
@ -1118,7 +1106,7 @@ func TestRestoreAllGrabOldLock(t *testing.T) {
},
}
runner := newInternal(&fexec, ProtocolIpv4, TestLockfilePath)
runner := newInternal(&fexec, ProtocolIPv4, TestLockfilePath)
defer os.Remove(TestLockfilePath)
// Grab the abstract @xtables socket
@ -1158,7 +1146,7 @@ func TestRestoreAllWaitBackportedIptablesRestore(t *testing.T) {
func(cmd string, args ...string) exec.Cmd { return fakeexec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := newInternal(&fexec, ProtocolIpv4, TestLockfilePath)
runner := newInternal(&fexec, ProtocolIPv4, TestLockfilePath)
defer os.Remove(TestLockfilePath)
err := runner.RestoreAll([]byte{}, NoFlushTables, RestoreCounters)

2
pkg/util/iptables/monitor_test.go
View File

@ -180,7 +180,7 @@ func (mfc *monitorFakeCmd) Stop() {
func TestIPTablesMonitor(t *testing.T) {
mfe := newMonitorFakeExec()
ipt := New(mfe, ProtocolIpv4)
ipt := New(mfe, ProtocolIPv4)
var reloads uint32
stopCh := make(chan struct{})

21
pkg/util/iptables/testing/fake.go
View File

@ -57,17 +57,17 @@ type Rule map[string]string
type FakeIPTables struct {
hasRandomFully bool
Lines []byte
ipv6 bool
protocol iptables.Protocol
}
// NewFake returns a no-op iptables.Interface
func NewFake() *FakeIPTables {
return &FakeIPTables{}
return &FakeIPTables{protocol: iptables.ProtocolIPv4}
}
// NewIpv6Fake returns a no-op iptables.Interface with IsIPv6() == true
func NewIpv6Fake() *FakeIPTables {
return &FakeIPTables{ipv6: true}
// NewIPv6Fake returns a no-op iptables.Interface with IsIPv6() == true
func NewIPv6Fake() *FakeIPTables {
return &FakeIPTables{protocol: iptables.ProtocolIPv6}
}
// SetHasRandomFully is part of iptables.Interface
@ -101,9 +101,14 @@ func (*FakeIPTables) DeleteRule(table iptables.Table, chain iptables.Chain, args
return nil
}
// IsIpv6 is part of iptables.Interface
func (f *FakeIPTables) IsIpv6() bool {
return f.ipv6
// IsIPv6 is part of iptables.Interface
func (f *FakeIPTables) IsIPv6() bool {
return f.protocol == iptables.ProtocolIPv6
}
// Protocol is part of iptables.Interface
func (f *FakeIPTables) Protocol() iptables.Protocol {
return f.protocol
}
// Save is part of iptables.Interface